Method and system for secure key rotation
This invention discloses a novel system for securing and using payment token data in a system for processing electronic payment transactions that does not require down-time for rekeying encryption keys when the keys are rotated.
1. A computer system for executing an electronic payment transaction while conducting a key rotation and re-keying comprising:
a transaction server comprised of:
a card vault component, comprised of a payment token in encrypted form and a corresponding token encryption key identifier;
a data structure comprised of a first data encryption key stored in encrypted form and a second data encryption key stored in encrypted form and a corresponding first key identifier and second key identifier;
a data memory comprised of program code that when executed causes the transaction server to:
decrypt the first and second data encryption keys;
store the decrypted first and second data encryption keys only in a local data memory of the transaction server that is executing the electronic payment transactions;
determine the condition that either the first data encryption key or the second data encryption key identifiers match the token encryption key identifier;
determine which of the members of a set of the first data encryption key and the second data encryption key is one generation older than the other data encryption key in the set;
decrypt the payment token using the determined data encryption key; and
process the electronic payment transaction using the decrypted payment token.
2. The system of claim 1 where the local memory is one of: a CPU register, a CPU cache location, a CPU stack location.
3. The system of claim 1 where the local memory is volatile memory local to the CPU comprising the transaction server.
4. The system of claim 1 where the program code further causes the transaction server to:
determine if at least one of the first and second data encryption keys does not match any data encryption key identifier stored in a data encryption key data table stored in the computer system; and
fetch a third data encryption key from a key database.
5. A method of conducting an electronic payment transaction by a transaction server while conducting a key rotation and re-keying comprising:
storing in a card vault component, a payment token in encrypted form and a corresponding token encryption key identifier;
generating a data structure comprised of a first data encryption key stored in encrypted form and a second data encryption key stored in encrypted form and a corresponding first key identifier and second key identifier;
decrypting the first and second data encryption keys;
storing the decrypted first and second data encryption keys only in a local data memory of the transaction server that is executing the electronic payment transactions;
determining the condition that at least one of the first and second data encryption key identifiers match the token encryption key identifier;
determining which of the members of a set of the first data encryption key and the second data encryption key is at least one generation older than the other data encryption key in the set;
decrypting the payment token using the determined encryption key; and
processing the transaction using the decrypted payment token.
6. The method of claim 5 where the local memory is one of: a CPU register, a CPU cache location, a CPU stack location.
7. The method of claim 5 where the local memory is volatile memory local to the CPU comprising the transaction server.
8. The method of claim 5 further comprising:
determining if a data encryption key identifier of at least one of the first and second data encryption keys does not match any data encryption key identifier stored in a data encryption key data table; and
in dependence on the determining, fetching a third data encryption key from a key database.